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Dated: 14 June 2022 


Subject: Update to GVL & TCF Technical Specification Vendor Device Storage & Operational 
Disclosures 


All Vendor & CMPs, 


This communication gives you formal notification of 2 updates to the following TCF 
resources: 


1. TCF registration information required from Vendors when registering on the Global 
Vendor List (GVL). 
2. TCF Technical Specification Vendor Device Storage & Operational Disclosures. 


TCF Vendor Registration Update 


The update applies to the following field that refers to international data transfer: 
Field name: Do you transfer data out of EU/EEA?* 
When applicable the field has been updated with a dedicated disclaimer as follows: 


“Certain transfer mechanisms do not automatically ensure an adequate level of data 
protection on their own under GDPR and may need to be accompanied by supplementary 
measures depending on the circumstances” 


When considering what is applicable to your operation the field has also been updated to 
allow you to indicate “supplementary measures” at the same time the option to indicate 
“other” has been removed. 

Note: given this update you may wish to update your registration here 


TCF Technical Specification Vendor Device Storage & Operational Disclosures 
update 


Your attention is drawn to the following points of clarification that are now described in the 
technical specification here 


1. Vendors: the specification has been updated to clarify that there are no 
assumptions or requirements describing the URL and the filename that links to the 
required JSON resource that you are asked to provide during registration. 

2. CMPs: the specification has been updated to clarify that regardless of whether the 
CMP requests the JSON file from the vendor's server or CMP's server, Access-Control- 
Allow-Credentials must be set to false to not include any cookie in the request. 


Update of the GVL registration : addition of new fields & update to the 


As notified March 14 (see official notification here), all Vendors are requested to expand the 
information required from when registering on the Global Vendor List (GVL) with the 
addition of a number of new fields including an update to the field 
deviceStorageDisclosureUr/ that now requires Vendors to provide a secure URL to a JSON 
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resource containing the information described in the technical specification (including the 
clarification described above). 


Vendors are reminded that they must apply the necessary changes to their registration b 
July 14 2022. Failure to make these registration updates by this date could result in your 
suspension from the GVL until your registration is updated. 
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